2019

Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date,

Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead

In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local a

libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image d

IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through

IBM QRadar SIEM 7.2 and 7.3 fails to adequately filter user-controlled input data for syntax that has control-plane impl

OX App Suite 7.8.4 and earlier allows Information Exposure.

TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filt

ARM Trusted Firmware-A allows information disclosure.

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h

The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir para

The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the di

The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename)

Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANS

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called und

IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.

IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be u

LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation.

LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sen

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allow

index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrate

A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could

Certain Lexmark CX, MX, X, XC, XM, XS, and 6500e devices before 2019-02-11 allow remote attackers to erase stored shortc

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" func

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial

V20 PRO L-01J software version L01J20c and L01J20d has a NULL pointer exception flaw that can be used by an attacker to

In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are n

A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php d

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the impro

A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to r

In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid

PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png file.

Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdr

IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the upd

Buffer Access with Incorrect Length Value in McAfee Agent (MA) 5.x allows remote unauthenticated users to potentially ca

In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-privat

If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not dis

In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires

In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could caref

NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can

Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2

PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png

Checkstyle before 8.18 loads external DTDs by default.

Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update

CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controll

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an

PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing o

PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uplo

PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such a